[PLUG] makeshift forensic copy with scp

[Michael Lazin via plug <plug@lists.phillylinux.org>]

I have a system that I found malware on and I want to examine it locally.  I connected to it with ssh as root, I know this is a risky setup but it is only internally facing, which is why I have great curiosity.  I am using scp to copy the full filesystem over the network but I have a fear that symlinks such as those in /proc could make it run forever.  How does scp handle syminks?  Will it loop and never end or will my process finish?  

Thank you,

Michael Lazin

.. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug